X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/973689b1de83eb3dee860a3bb6895e8d5a7b42b2..5800e3234f2594639d82e5063d9c522c6a881d25:/src/src/transports/smtp.c

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index 7d5eb35a5..e38ea1502 100644
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -1433,10 +1433,17 @@ smtp_transport_options_block * ob = sx->conn_args.ob;	/* transport options */
 host_item * host = sx->conn_args.host;			/* host to deliver to */
 int rc;
 
+/* Set up globals for error messages */
+
+authenticator_name = au->name;
+driver_srcfile = au->srcfile;
+driver_srcline = au->srcline;
+
 sx->outblock.authenticating = TRUE;
 rc = (au->info->clientcode)(au, sx, ob->command_timeout,
 			    sx->buffer, sizeof(sx->buffer));
 sx->outblock.authenticating = FALSE;
+driver_srcfile = authenticator_name = NULL; driver_srcline = 0;
 DEBUG(D_transport) debug_printf("%s authenticator yielded %d\n", au->name, rc);
 
 /* A temporary authentication failure must hold up delivery to
@@ -2148,7 +2155,7 @@ if (continue_hostname && continue_proxy_cipher)
     DEBUG(D_transport)
       debug_printf("Closing proxied-TLS connection due to SNI mismatch\n");
 
-    HDEBUG(D_transport|D_acl|D_v) debug_printf_indent("  SMTP>> QUIT\n");
+    smtp_debug_cmd(US"QUIT", 0);
     write(0, "QUIT\r\n", 6);
     close(0);
     continue_hostname = continue_proxy_cipher = NULL;
@@ -2232,6 +2239,9 @@ if (!continue_hostname)
   sx->peer_limit_mail = sx->peer_limit_rcpt = sx->peer_limit_rcptdom =
 #endif
   sx->avoid_option = sx->peer_offered = smtp_peer_options = 0;
+#ifndef DISABLE_CLIENT_CMD_LOG
+  client_cmd_log = NULL;
+#endif
 
 #ifndef DISABLE_PIPE_CONNECT
   if (  verify_check_given_host(CUSS &ob->hosts_pipe_connect,
@@ -3163,6 +3173,7 @@ sx->cctx.sock = -1;
 (void) event_raise(sx->conn_args.tblock->event_action, US"tcp:close", NULL, NULL);
 #endif
 
+smtp_debug_cmd_report();
 continue_transport = NULL;
 continue_hostname = NULL;
 return yield;
@@ -3685,7 +3696,7 @@ int rc;
 
 uschar *message = NULL;
 uschar new_message_id[MESSAGE_ID_LENGTH + 1];
-smtp_context * sx = store_get(sizeof(*sx), TRUE);	/* tainted, for the data buffers */
+smtp_context * sx = store_get(sizeof(*sx), GET_TAINTED);	/* tainted, for the data buffers */
 BOOL pass_message = FALSE;
 #ifdef EXPERIMENTAL_ESMTP_LIMITS
 BOOL mail_limit = FALSE;
@@ -3755,7 +3766,7 @@ if (tblock->filter_command)
 
   if (!transport_set_up_command(&transport_filter_argv,
 	tblock->filter_command, TRUE, DEFER, addrlist,
-	string_sprintf("%.50s transport", tblock->name), NULL))
+	string_sprintf("%.50s transport filter", tblock->name), NULL))
     {
     set_errno_nohost(addrlist->next, addrlist->basic_errno, addrlist->message, DEFER,
       FALSE, &sx->delivery_start);
@@ -4078,7 +4089,7 @@ else
       sx->send_quit = FALSE;	/* avoid sending it later */
 
 #ifndef DISABLE_TLS
-      if (sx->cctx.tls_ctx)	/* need to send TLS Close Notify */
+      if (sx->cctx.tls_ctx && sx->send_tlsclose)	/* need to send TLS Close Notify */
 	{
 # ifdef EXIM_TCP_CORK		/* Use _CORK to get Close Notify in FIN segment */
 	(void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
@@ -4422,7 +4433,8 @@ if (!sx->ok)
 # ifndef DISABLE_TLS
 	if (sx->cctx.tls_ctx)
 	  {
-	  tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WAIT);
+	  tls_close(sx->cctx.tls_ctx,
+		    sx->send_tlsclose ? TLS_SHUTDOWN_WAIT : TLS_SHUTDOWN_WONLY);
 	  sx->cctx.tls_ctx = NULL;
 	  }
 # endif
@@ -4633,7 +4645,8 @@ if (sx->completed_addr && sx->ok && sx->send_quit)
 	    a new EHLO. If we don't get a good response, we don't attempt to pass
 	    the socket on. */
 
-	  tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WAIT);
+	  tls_close(sx->cctx.tls_ctx,
+	    sx->send_tlsclose ? TLS_SHUTDOWN_WAIT : TLS_SHUTDOWN_WONLY);
 	  sx->send_tlsclose = FALSE;
 	  sx->cctx.tls_ctx = NULL;
 	  tls_out.active.sock = -1;
@@ -4735,7 +4748,7 @@ if (sx->send_quit)
   {			/* Use _MORE to get QUIT in FIN segment */
   (void)smtp_write_command(sx, SCMD_MORE, "QUIT\r\n");
 #ifndef DISABLE_TLS
-  if (sx->cctx.tls_ctx)
+  if (sx->cctx.tls_ctx && sx->send_tlsclose)
     {
 # ifdef EXIM_TCP_CORK	/* Use _CORK to get TLS Close Notify in FIN segment */
     (void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
@@ -4790,10 +4803,15 @@ if (sx->send_quit || tcw_done && !tcw)
     while (!sigalrm_seen && n > 0);
     ALARM_CLR(0);
 
+    if (sx->send_tlsclose)
+      {
 # ifdef EXIM_TCP_CORK
-    (void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
+      (void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
 # endif
-    tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WAIT);
+      tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WAIT);
+      }
+    else
+      tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WONLY);
     sx->cctx.tls_ctx = NULL;
     }
 #endif
@@ -4817,6 +4835,7 @@ HDEBUG(D_transport|D_acl|D_v) debug_printf_indent("  SMTP(close)>>\n");
 sx->cctx.sock = -1;
 continue_transport = NULL;
 continue_hostname = NULL;
+smtp_debug_cmd_report();
 
 #ifndef DISABLE_EVENT
 (void) event_raise(tblock->event_action, US"tcp:close", NULL, NULL);
@@ -5090,8 +5109,11 @@ if (!hostlist || (ob->hosts_override && ob->hosts))
     else
       if (ob->hosts_randomize) s = expanded_hosts = string_copy(s);
 
-    if (is_tainted2(s, LOG_MAIN|LOG_PANIC, "Tainted host list '%s' from '%s' in transport %s", s, ob->hosts, tblock->name))
+    if (is_tainted(s))
       {
+      log_write(0, LOG_MAIN|LOG_PANIC,
+	"attempt to use tainted host list '%s' from '%s' in transport %s",
+	s, ob->hosts, tblock->name);
       /* Avoid leaking info to an attacker */
       addrlist->message = US"internal configuration error";
       addrlist->transport_return = PANIC;
@@ -5588,7 +5610,7 @@ retry_non_continued:
 
       if (expanded_hosts)
 	{
-	thost = store_get(sizeof(host_item), FALSE);
+	thost = store_get(sizeof(host_item), GET_UNTAINTED);
 	*thost = *host;
 	thost->name = string_copy(host->name);
 	thost->address = string_copy(host->address);